Add dynamic config to disable frontend schedule rpcs (#2908)

common/dynamicconfig/constants.go

@@ -218,6 +218,8 @@ const (
 	// KeepAliveTimeout After having pinged for keepalive check, the server waits for a duration
 	// of Timeout and if no activity is seen even after that the connection is closed.
 	KeepAliveTimeout = "frontend.keepAliveTimeout"
+	// FrontendEnableSchedules enables schedule-related RPCs in the frontend
+	FrontendEnableSchedules = "frontend.enableSchedules"
 
 	// DeleteNamespaceDeleteActivityRPS is RPS per every parallel delete executions activity.
 	// Total RPS is equal to DeleteNamespaceDeleteActivityRPS * DeleteNamespaceConcurrentDeleteExecutionsActivities.

service/frontend/errors.go

@@ -86,5 +86,6 @@ var (
 	errUnableToStartWorkflowMessage                   = "Unable to start %s workflow: %v."
 	errWorkflowReturnedErrorMessage                   = "Workflow %s returned an error: %v."
 
-	errListNotAllowed = serviceerror.NewPermissionDenied("List is disabled on this namespace.", "")
+	errListNotAllowed      = serviceerror.NewPermissionDenied("List is disabled on this namespace.", "")
+	errSchedulesNotAllowed = serviceerror.NewPermissionDenied("Schedules are disabled on this namespace.", "")
 )

service/frontend/service.go

@@ -138,6 +138,9 @@ type Config struct {
 	// Number of concurrent delete executions activities.
 	// Must be not greater than 256 and number of worker cores in the cluster.
 	DeleteNamespaceConcurrentDeleteExecutionsActivities dynamicconfig.IntPropertyFn
+
+	// Enable schedule-related RPCs
+	EnableSchedules dynamicconfig.BoolPropertyFnWithNamespaceFilter
 }
 
 // NewConfig returns new service config with default values
@@ -194,6 +197,8 @@ func NewConfig(dc *dynamicconfig.Collection, numHistoryShards int32, esIndexName
 
 		DeleteNamespaceDeleteActivityRPS:                    dc.GetIntProperty(dynamicconfig.DeleteNamespaceDeleteActivityRPS, 100),
 		DeleteNamespaceConcurrentDeleteExecutionsActivities: dc.GetIntProperty(dynamicconfig.DeleteNamespaceConcurrentDeleteExecutionsActivities, 4),
+
+		EnableSchedules: dc.GetBoolPropertyFnWithNamespaceFilter(dynamicconfig.FrontendEnableSchedules, false),
 	}
 }
 

service/frontend/workflowHandler.go

@@ -3033,6 +3033,10 @@ func (wh *WorkflowHandler) CreateSchedule(ctx context.Context, request *workflow
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	// a schedule id is a workflow id so validate it the same way
 	if err := wh.validateWorkflowID(request.ScheduleId); err != nil {
 		return nil, err
@@ -3162,6 +3166,10 @@ func (wh *WorkflowHandler) DescribeSchedule(ctx context.Context, request *workfl
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	namespaceID, err := wh.namespaceRegistry.GetNamespaceID(namespace.Name(request.GetNamespace()))
 	if err != nil {
 		return nil, err
@@ -3316,6 +3324,10 @@ func (wh *WorkflowHandler) UpdateSchedule(ctx context.Context, request *workflow
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	if len(request.GetRequestId()) > wh.config.MaxIDLengthLimit() {
 		return nil, errRequestIDTooLong
 	}
@@ -3383,6 +3395,10 @@ func (wh *WorkflowHandler) PatchSchedule(ctx context.Context, request *workflows
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	if len(request.GetRequestId()) > wh.config.MaxIDLengthLimit() {
 		return nil, errRequestIDTooLong
 	}
@@ -3444,6 +3460,10 @@ func (wh *WorkflowHandler) ListScheduleMatchingTimes(ctx context.Context, reques
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	namespaceID, err := wh.namespaceRegistry.GetNamespaceID(namespace.Name(request.GetNamespace()))
 	if err != nil {
 		return nil, err
@@ -3510,6 +3530,10 @@ func (wh *WorkflowHandler) DeleteSchedule(ctx context.Context, request *workflow
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	namespaceID, err := wh.namespaceRegistry.GetNamespaceID(namespace.Name(request.GetNamespace()))
 	if err != nil {
 		return nil, err
@@ -3547,6 +3571,10 @@ func (wh *WorkflowHandler) ListSchedules(ctx context.Context, request *workflows
 		return nil, errRequestNotSet
 	}
 
+	if !wh.config.EnableSchedules(request.Namespace) {
+		return nil, errSchedulesNotAllowed
+	}
+
 	if request.GetMaximumPageSize() <= 0 {
 		request.MaximumPageSize = int32(wh.config.VisibilityMaxPageSize(request.GetNamespace()))
 	}